RegistrationMagic EUVD-2026-68793

The RegistrationMagic plugin must be installed and activated on a WordPress site, with at least one registration form rendered on a publicly accessible page (the plugin's primary purpose, meaning this is the default operational state). The attacker requires no account or credentials on the target site. Exploitation requires that a victim - most impactfully a WordPress administrator - follow a crafted link or visit an attacker-controlled page that triggers the cross-site request. The UI:R metric limits exploitation to scenarios where social engineering or phishing is employed to deliver the malicious URL; fully passive, drive-by exploitation without victim interaction is not possible. Sites that have deactivated the plugin or removed all RegistrationMagic shortcodes from public pages are not exploitable.

The CVSS 7.1 High score reflects a practical risk profile: network-accessible (AV:N), low complexity (AC:L), no authentication required from the attacker (PR:N), but user interaction is required (UI:R), meaning the victim must click a crafted link or visit a malicious page. The scope change (S:C) elevates real-world impact because a successful exploitation can compromise sessions of authenticated WordPress administrators who visit the crafted URL - a common phishing vector. EPSS data is not available in the provided input, limiting probabilistic exploitation forecasting. KEV status is not confirmed, and no POC is publicly documented at this time, which moderates urgency compared to a KEV-listed flaw. However, unauthenticated XSS in public-facing WordPress registration forms is a well-understood, easy-to-exploit class that historically sees rapid community exploitation once disclosed via Patchstack's public database.

An attacker crafts a URL targeting a RegistrationMagic-powered registration page with a malicious JavaScript payload embedded in a vulnerable parameter. The attacker delivers this link to a WordPress administrator via phishing email or forum post; when the administrator clicks the link while authenticated to the WordPress dashboard, the script executes in their browser, potentially exfiltrating session cookies or initiating unauthorized administrative actions. No POC code is publicly known, but the unauthenticated, low-complexity nature of the flaw makes independent rediscovery straightforward for motivated threat actors familiar with WordPress plugin vulnerability patterns.